PSGumshoe

2.0.0

PowerShell module for data collection, incident response, hunting, and security analysis

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name PSGumshoe -RequiredVersion 2.0.0

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name PSGumshoe -Version 2.0.0

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Package Details

Author(s)

  • Carlos Perez (carlos_perez@darkoperator.com)

Functions

Get-NamedPipe Measure-CharacterFrequency Measure-DamerauLevenshteinDistance Measure-VectorSimilarity Get-DSForest Get-DSDirectoryEntry Get-DSDirectorySearcher Get-DSComputer Get-DSDomain Get-DSGpo Get-DSUser Get-DSGroup Get-DSReplicationAttribute Get-DSGroupMember Get-DSOU Get-DSTrust Get-DSObjectAcl Get-EventPsEngineState Get-EventPsScriptCommandExec Get-EventPsPipeline Get-EventPsIPC Get-EventPsScriptBlock Get-WinEventBaseXPathFilter Get-SysmonProcessAccess Get-SysmonConfigChange Get-SysmonConnectNamedPipe Get-SysmonCreateNamedPipe Get-SysmonCreateRemoteThreadEvent Get-SysmonDriverLoadEvent Get-SysmonFileCreateEvent Get-SysmonFileStreamHash Get-SysmonFileTime Get-SysmonFileDeleteDetectedEvent Get-SysmonImageLoadEvent Get-SysmonNetworkConnect Get-SysmonProcessCreateEvent Get-SysmonProcessTampering Get-SysmonProcessTerminateEvent Get-SysmonRawAccessRead Get-SysmonRegistryKey Get-SysmonRegistryRename Get-SysmonRegistrySetValue Get-SysmonServiceStateChange Get-SysmonWmiBinding Get-SysmonWmiConsumer Get-SysmonWmiFilter Get-SysmonDNSQuery Get-SysmonProcessActivityEvent Get-SysmonClipboardChange Get-SysmonError Get-EventSystemLogon Get-EventSystemLogoff Get-EventTerminalLogon Get-EventTerminalLogoff Get-EventScheduledTaskStart Get-EventScheduledTaskProcess Get-EventScheduledTaskStop Get-EventScheduledTaskComplete Get-EventBitsTransferComplete Get-EventBitsTransferStart Get-SysmonAccessMask Get-SysmonRuleHash ConvertTo-SysmonRule Get-EventProcessCreate Clear-WinEvent Export-WinEvent Get-EventWmiQueryError Search-EventLogUserData Get-EventWmiProviderStart Get-EventWmiOperationFailure Get-EventWmiTemporaryEvent Get-EventWmiPermanentEvent Get-CimLogonSession Get-CimProcessLogonSession Get-CimProcess Get-CimComputerInfo Get-CimDNSCache Get-CimNetLogon

Dependencies

This module has no dependencies.

FileList

Version History

Version Downloads Last updated
2.0.11 1,313 7/14/2023
2.0.10 81 5/18/2023
2.0.9 68 4/7/2023
2.0.8 12 4/6/2023
2.0.7 78 2/6/2023
2.0.6 7 2/1/2023
2.0.5 6 2/1/2023
2.0.4 38 10/8/2022
2.0.3 23 9/12/2022
2.0.2 128 3/29/2022
2.0.1 18 3/27/2022
2.0.0 (current version) 18 3/26/2022
1.7.3 312 4/22/2021
1.7.2 16 4/21/2021
1.7.1 81 3/13/2021
1.7 14 3/13/2021
1.6 77 1/13/2021
1.5 88 6/3/2020
1.3 15 6/2/2020
Show less